The latest Android Fakeapp variant steals user credentials then uses deep links of the legitimate Uber app to hide the fact.

https://www.symantec.com/blogs/threat-intelligence/android-malware-uber-credentials-deep-links